CVE-2026-110536: OS Command Injection in D-Link DIR-868L

This vulnerability in D-Link DIR-868L version 2.01b05 allows remote attackers to perform OS command injection via manipulation of the SOAPACTION argument in the HNAP CGI Handler's system function located in /htdocs/cgibin. The flaw enables execution of arbitrary operating system commands without authentication, resulting in full compromise potential. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements. Public exploit disclosure exists, but no known exploits in the wild have been reported. No vendor patch or mitigation details are provided in the input data.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device without authentication, potentially leading to full device compromise, data theft, disruption of service, or further network penetration. The vulnerability impacts confidentiality, integrity, availability, and security controls at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device's management interfaces and monitor for suspicious activity related to HNAP CGI Handler requests. Avoid exposing the device to untrusted networks.